quasar | ceeca3a0c28712758aaf14261e0212ca59a5341ceef72b8cb7b9194c0cac8b96 | Triage

Sharing

General

Target

Solara setup(disable anti virrus if not working).exe
Size

3.1MB
Sample

241123-p9xxysvpaw
MD5

b54af7138ea30f052019271154f2cf27
SHA1

60abf1be2c5bc3ba182bc04da0ccda264d8b2e82
SHA256

ceeca3a0c28712758aaf14261e0212ca59a5341ceef72b8cb7b9194c0cac8b96
SHA512

21fd18a92bdba7f23e81ff5266198579b8f9bf0991c15ee64fdcdecb84ca625fddbdeac55a394d79c6b9019d8e87b32c87d7d22ac474133df2f3a5c813347bf8
SSDEEP

49152:WvHt62XlaSFNWPjljiFa2RoUYIlkRJ6ebR3LoGdFTHHB72eh2NT:WvN62XlaSFNWPjljiFXRoUYIlkRJ6Y

Score

10^/10

quasar victim persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

victim

C2

192.168.0.8:4782

Mutex

57b923c6-9eab-4306-8c4f-85ce7303d6e6

Attributes

encryption_key
DECB09D2F1BE5F9F9292D355A199E899228C4D86
install_name
Client.exe
log_directory
Logs
reconnect_delay
100
startup_key
Client Startup
subdirectory
SubDir

Targets

- Target
  
  Solara setup(disable anti virrus if not working).exe
- Size
  
  3.1MB
- MD5
  
  b54af7138ea30f052019271154f2cf27
- SHA1
  
  60abf1be2c5bc3ba182bc04da0ccda264d8b2e82
- SHA256
  
  ceeca3a0c28712758aaf14261e0212ca59a5341ceef72b8cb7b9194c0cac8b96
- SHA512
  
  21fd18a92bdba7f23e81ff5266198579b8f9bf0991c15ee64fdcdecb84ca625fddbdeac55a394d79c6b9019d8e87b32c87d7d22ac474133df2f3a5c813347bf8
- SSDEEP
  
  49152:WvHt62XlaSFNWPjljiFa2RoUYIlkRJ6ebR3LoGdFTHHB72eh2NT:WvN62XlaSFNWPjljiFXRoUYIlkRJ6Y
Score

10^/10

quasar victim persistence spyware trojan
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar family
  quasar
- Quasar payload
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

quasarvictimpersistencespywaretrojan

behavioral2

quasarvictimpersistencespywaretrojan